Security Vulnerabilities Found in Over 30,000 Internet-Exposed Solar Photovoltaic Devices

A new study by Forescout – Vedere Labs, published on June 5, identified exposed management interfaces in nearly 35,000 solar photovoltaic systems from 42 vendors worldwide.

Forescout is a cybersecurity company that specializes in network, endpoint, and IoT security. In collaboration with Vedere Labs, they conducted research and discovered 46 vulnerabilities in solar power devices exposed to the internet. These vulnerabilities could allow hackers to hijack the systems, steal data, disrupt grid stability, cause blackouts, or use these devices as entry points to critical infrastructure.

According to the research, there is a serious risk of a breach in numerous solar power devices worldwide.

• Almost 35,000 solar power devices are vulnerable to cyberattacks.
• 42 vendors identified as having exposed management interfaces.
• Most popular vendors include SMA, Sungrow, and Growatt.
• The countries with the most exposed devices are Germany (20%), Greece (20%), Japan (9%), Portugal (9%), and Italy (6%).
• The five most popular brands represent over 70% of the exposed devices.
• Over 13,000 SMA Sunny WebBox devices exposed online exhibit a hard-coded account security vulnerability.
• SolarView compact solar power devices revealed vulnerabilities actively exploited by botnets.

The exposed and vulnerable devices include those often used in renewable energy systems, such as inverters, data loggers, and monitors. If compromised, there’s a serious risk of power grid disruption, hijacking, data breaches, data theft, and unauthorized access to major network infrastructures.

To secure smart inverters and industrial installations, the team behind the research recommends following NIST and DOE guidelines, and deploying patches to fix known vulnerabilities.

Every day, the world becomes more connected, and while this is often regarded as a good indicator of human advancements, it carries serious risks, especially for people and companies unaware of it. If cybercriminals can target powerful devices like solar panels, it’s easy to imagine how simple it is to breach a smartphone or computer.

Nowadays, no online device is safe. To fight this trend, we recommend reading the following articles:

• Biggest cybersecurity threats to look out for
• Best cybersecurity steps to protect yourself from a cyber attack
• Best cybersecurity tips for small businesses